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WHAT IS CLAIMED TS: 

A method for identifying protocol encapsulation in received 
network data comprising providing a grammar and parsing incoming network data using 
said grammar, said network data being organized into data packets. 



2. The methoji 
the method further including pro riding 
representing said grammar graph 



of claim 1 wherein said grammar is a grammar graph, 
a deterministic finite automaton (DFA) 



3. The method of claim 1 further including scanning said incoming 
network data using lexical token scanning to produce plural lexical tokens, said step of 
parsing including parsing said lexical tokens. 



1 4. The method of claim 3 wherein said lexical scanning includes 

2 providing a set of regular explosions. 

1 5. The mjbthod of claim 3 further including providing a deterministic 

2 finite automaton (DFA), said DFA including a representation of said lexical tokens and 

3 said grammar, said step of scanning including recognizing lexical tokens contained in 

4 said data packets using said DFA, said step of parsing including identifying grammatical 

5 structure among said lexical tokens using said DFA to identify protocol encapsulation in 

6 said incoming network cjata. 

1 ^01 Ih a data packet network switching device, a method for processing 

2 data packets comprising: 

3 providing a grammar; 

4 receiving plural data packets, each having a length not necessarily equal to 

5 one another; and 

6 foi/each data packet, lexically scanning said data packet to produce plural 

7 lexical tokens, parsing said lexical tokens to produce one or more identified protocols, 

8 and processing ^aid data packet based on said identified protocols. 

1 / 7. The method of claim 6 further including compiling said grammar 

2 to produce a grammar graph. 
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8. The method Jof claim 7 wherein said lexical scanning includes 
providing regular expressions for identifying said lexical tokens. 

9. The methdd of claim 8 further including compiling said regular 
expressions are into a deterministic finite automaton (DFA). 

10. The mepod of claim 9 further including incorporating said 
grammar graph into said DFJ 

In a dstfta packet receiving and forwarding device, a method for 
processing data packets comprising a stream of data, said method comprising: 

receiving a description of grammar rules in a grammar packet 
classification language; 

compiling sajid grammar packet classification language to produce a 
grammar graph; 

configuring/a programmable grammatical packet classifier with said 
grammar graph; 

parsing saiH data stream with said grammatical packet classifier to identify 
a protocol structure in a ijeceived data packet; and 

processing said received data packet in accordance with said protocol 

structure. 

12. The method of claim 1 1 further including: 
receiving a description of classification rules in a lexical classification 

language; 

compiling said classification language to produce a deterministic finite 
automaton (DFA) comprising plural states; 

configuring said hardware packet classifier with said DFA; and 

scanning said data stream with said hardware packet classifier to produce 
plural lexical tokens, 

whdrein said parsing is a step of parsing said lexical tokens. 

137 The method of claim 12 wherein said grammar graph is 
incorporated into/said DFA. 
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14. The method of cjlaim 12 wherein said lexical classification 
language includes regular expressions 



1 15. The method o 

2 arithmetic and logic operations. 

1 16. The method of 

2 include skip operations. 

1 17. The method of 

2 include data storage operations. 
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A network data 



data; 



claim 14 wherein said regular expressions include 



claim 15 wherein said regular expressions further 



claim 16 wherein said regular expressions further 



packet classifier comprising: 



input port for receiving network data packets comprising a stream of 



configured with data representing a deterministic 
presenting a grammar graph and plural regular 



a memory assemblage 
finite automaton (DFA), said DFA 
expressions; and 

decompression logid operatively coupled to said memory assemblage and 
configured to scan said stream of data with said DFA to find a matching one of said 
regular expressions thereby producing plural lexical tokens, 

said decompression logic further configured to parse said lexical tokens 
with said DFA to identify a protocol structure in a received network data packet, 

wherein processing of said network data packet depends on said protocol 

structure. 

19. The classifier of claim 18 wherein some of said regular expressions 
include arithmetic instruction^ and logic instructions, said memory assemblage further 
configured to contain said instructions, the classifier further including an arithmetic logic 
unit operatively coupled to said decompression logic and configured to execute said 
instructions. 

20. The ilassifier of claim 19 further including at least one register 
operatively coupled to said arithmetic logic unit, said arithmetic logic unit further 
configured to store data into said register in response to a save instruction. 
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1 21. Thee 

2 coupled to said logic component 

3 response a skip instruction 



1 22. Thee 

2 vary from one packet to anojher, 
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2 form. 
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assifier of claim 1 9 further including skip logic operatively 
and configured to skip over an amount of data in 



assifier of claim 1 8 wherein said network data packets can 



23. The c assifier of claim 1 8 wherein said DFA is in compressed 



1 24. The ilassifier of claim 23 wherein said DFA comprises plural non- 

2 default states and plural default states, and said memory assemblage comprises a base 

3 memory, a next-state memory, and a default-state memory; said base memory configured 

4 to contain address locations of said next-state memory, said next-state memory 

5 representing all of said non-default states, said default-state memory representing all of 

6 said default states. 



1 25. 

2 access memories. 



memories. 



26. 



The classifier of claim 24 wherein said memories are random 



rhe classifier of claim 24 wherein said memories are read-only 



f A network packet classifier comprising: 
mean^ for receiving an incoming network packet; and 
meanjS for identifying protocol structure in said network packet including 
means for scanning/to match patterns in its constituent data against plural regular 
expressions to produce lexical tokens and means for parsing through said lexical tokens 
using a grammar. 

2#. The classifier of claim 27 wherein said means for scanning 
includes a memdry component configured with data to represent a deterministic finite 
automaton (DFA). 



1 /29. The classifier of claim 28 wherein said memory component is 

2 further configured to include said grammar. 
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30. Tfefe classifier of claim 27 wherein said regular expressions include 
arithmetic specifiers and said means for classifying includes an arithmetic logic unit 
configured to perform operations in accordance with said arithmetic specifiers. 
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